fix(land): keep the fixer alive through output bursts and say why it stopped

README.md

@@ -523,18 +523,24 @@ The payload adds `agent` and `model` metadata to each result (`--model <id>`
 selects the default Codex model; unknown models fall back to `Codex`).
 Reasons and diagnoses are single lines. Fixed heads must be committed on `pr-<n>`.
 
-Jobs and attempts persist across daemon restarts. After the wrapper exits, the
+Jobs and attempts persist across daemon restarts. A running fixer outlives a
+restart only where the host leaves its process group alive (under systemd,
+`KillMode=process` on the daemon's unit); otherwise its handback names the signal
+and the restart. After the wrapper exits, the
 daemon validates every result, ancestry, and protected path before lease-pushing
 as the bot. The protected set as a whole must match the pinned head or its merge with the
 current base, including content and mode. It covers `flake.nix`, `flake.lock`,
 `shell.nix`, `default.nix`, `nix/`, `.envrc`, `.github/`, `.gitmodules`, and gitlinks
-anywhere. Collection copies at most 100 MiB of Git metadata into a clean object
-repository, ignores fixer configuration, and never follows Git alternates. Pack indexes are rebuilt with
+anywhere. Collection copies at most 100 MiB of Git metadata the fixer added into a
+clean object repository. It skips the packs fetched at launch, whose objects the clean
+repository borrows from the daemon's own. It ignores fixer configuration and never
+follows the fixer's Git alternates. Pack indexes are rebuilt with
 `git index-pack` rather than trusted; the fetch into the daemon's repository
 checks every object and link, since the import enables `fetch.fsckObjects=true`. It records `mechanical fix by <recorded agent/model>: <reason>` and the new head in
 `## Review`, enables head-pinned auto-merge, and adds `quest:merge`. Healthy PRs
 requeue unchanged. Forks refusing maintainer edits, refused pushes, invalid results,
-crashes, or the 60-minute fixer deadline hand back with a marked comment. A flaky
+crashes, or the 60-minute fixer deadline hand back with a marked comment naming the exit
+status or signal, with the tail of the job's retained log. A flaky
 requeue suggests a follow-up. Each maintainer pick gets one attempt; the daemon
 records the fixer's new auto-merge `enabledAt` so its second ejection hands back.
 A new maintainer pick resets the attempt. Host provisioning and isolation

quest/m0/host-land/README.md

@@ -95,5 +95,4 @@ can hand off instead.
 
 - [Gate host](/quest/m0/host-land/host.md) - kixelated/nixos runs the daemon as its own user, checks in nspawn containers, and retires the Actions runner
 - [Fixer proxy access](/quest/m0/host-land/fixer.md) - connect the nixos fixer container to CLIProxyAPI with the gate client key and maintainer login
-- [Fixer survives ejection](/quest/m0/host-land/fixer-survives.md) - the fixer finishes after every ejection and requeues collateral PRs itself
 - [Batch triage](/quest/m0/host-land/triage.md) - the fixer blames the failing PR before ejection, and a red base halts the queue

quest/m0/host-land/host.md

@@ -92,3 +92,15 @@ What remains:
   already rejects.
 - moq-bot's `organization_self_hosted_runners` write permission served only
   the retired runner; the maintainer may drop it.
+- Keep fixers running across a deploy: set `KillMode=process` on each
+  `quest-land-<repo>.service` in `modules/quest-land.nix`. The default
+  `control-group` sends SIGTERM to the daemon's detached fixer supervisor
+  too, so a fixer running during a deploy ends with exit 143. On 2026-10-31
+  that happened to moq's 23:22 batch
+  ([moq-dev/moq#7426](https://github.com/moq-dev/moq/pull/7426),
+  [moq-dev/moq#7084](https://github.com/moq-dev/moq/pull/7084)). The
+  daemon's in-flight check clients still exit on their next write to the
+  dead daemon's pipe. Check it by restarting the unit while a fixer runs:
+  the job should collect a result, not a handback naming SIGTERM. Keep
+  `ProcSubset=pid` off the unit: generation 45 had it, which hid
+  `/proc/sys/kernel/random/boot_id` from the daemon.

quest/m0/host-land/triage.md

@@ -49,10 +49,6 @@ wasting CI on bisection?"
 - Keep the fixer's untrusted-input rules: a PR's content cannot make the
   fixer blame another PR or skip the base check.
 
-## Required
-
-- [Fixer survives ejection](/quest/m0/host-land/fixer-survives.md) - the fixer has to finish before its triage can be trusted
-
 ## Related
 
 - [Fixer proxy access](/quest/m0/host-land/fixer.md) - how the fixer reaches its model

src/cli/land-fix.ts

@@ -127,7 +127,12 @@ export async function fix(
 		"-",
 	];
 	await new Promise<void>((done, reject) => {
-		const child = spawn(agent, argv, { cwd: root, env, stdio: ["pipe", "inherit", "inherit"] });
+		// Relay the agent's output through pipes of its own rather than letting it inherit ours. Once Bun writes
+		// to a pipe it marks that pipe non-blocking, and an inheriting child shares the flag: Codex then panicked
+		// (exit 101) with EAGAIN as soon as one command's output outran the host's reader.
+		const child = spawn(agent, argv, { cwd: root, env, stdio: ["pipe", "pipe", "pipe"] });
+		child.stdout.pipe(process.stdout, { end: false });
+		child.stderr.pipe(process.stderr, { end: false });
 		child.once("error", reject);
 		child.stdin.on("error", () => {});
 		child.stdin.end(`${prompt}\n\nFailure log: ${JSON.stringify(log)}\nPRs: ${numbers.join(", ")}\n`);

src/cli/land-fixer-repository.ts

@@ -19,7 +19,20 @@ import { pathToFileURL } from "node:url";
 import { git } from "./land";
 
 export const MAX_FIXER_BYTES = 100 * 1024 * 1024;
-export function importFixer(root: string, state: string, checkout: string, number: number, head: string): void {
+/**
+ * Import pr-N's objects. `known` names the packs fetched from `root` at launch: their objects are already in `root`,
+ * so they are neither copied nor counted, and the size bound applies to what the fixer added rather than to the
+ * repository's history (moq's alone exceeds it). A fixer that rewrote one only leaves its objects out of the import.
+ */
+export function importFixer(
+	root: string,
+	state: string,
+	checkout: string,
+	number: number,
+	head: string,
+	known: string[] = [],
+): void {
+	const launched = new Set(known.map((name) => name.replace(/\.pack$/, "")));
 	const source = join(checkout, ".git");
 	if (!lstatSync(checkout).isDirectory() || !lstatSync(source).isDirectory() || lstatSync(source).isSymbolicLink())
 		throw new Error("fixer .git must be a real directory");
@@ -35,6 +48,7 @@ export function importFixer(root: string, state: string, checkout: string, numbe
 			if (stat.isSymbolicLink() || (!stat.isDirectory() && !stat.isFile()))
 				throw new Error("fixer git metadata must contain only real files and directories");
 			if (stat.isDirectory()) walk(child, rel);
+			else if (relative === "objects/pack" && launched.has(name.replace(/\.[a-z]+$/, ""))) continue;
 			else {
 				bytes += stat.size;
 				if (bytes > MAX_FIXER_BYTES) throw new Error("fixer repository exceeds 100 MiB");
@@ -71,6 +85,13 @@ export function importFixer(root: string, state: string, checkout: string, numbe
 	const clean = mkdtempSync(join(state, "fix-import-"));
 	try {
 		git(clean, ["init", "--bare", "--quiet"]);
+		// The skipped launch packs' objects are the daemon's own: borrow them from its repository, never through
+		// any alternates the fixer wrote (deleted above), so the fixer's new commits connect to their history.
+		if (launched.size)
+			writeFileSync(
+				join(clean, "objects", "info", "alternates"),
+				`${join(git(root, ["rev-parse", "--absolute-git-dir"]), "objects")}\n`,
+			);
 		let copied = 0;
 		for (const path of objects) {
 			const data = read(path);

src/cli/land-fixer.ts

@@ -13,6 +13,7 @@ import {
 	rmSync,
 	writeFileSync,
 } from "node:fs";
+import { constants as osConstants } from "node:os";
 import { join } from "node:path";
 import { MERGE_LABEL } from "../core";
 import { GitHub, type GitHubDependencies, object, string } from "./github";
@@ -58,6 +59,10 @@ interface Job {
 	terminating?: number;
 	pid?: number;
 	identity?: string;
+	/** The launching daemon's process identity, to tell a restart from a crash. */
+	daemon?: string;
+	/** Packs fetched from the daemon's repository at launch; their objects are already there. */
+	packs?: string[];
 	results?: FixResult[];
 	error?: string;
 	handbacks?: Record<number, string>;
@@ -194,6 +199,8 @@ export async function startFixer(
 		plan: failure.plan,
 		numbers: entries.map((entry) => entry.number),
 		started: deps.now(),
+		daemon: identity(process.pid),
+		packs: readdirSync(join(checkout, ".git", "objects", "pack")).filter((name) => name.endsWith(".pack")),
 		published: [],
 	};
 	save(path, job);
@@ -327,7 +334,8 @@ export async function collectFixers(
 		try {
 			output.push(...(await collectJob(root, state, path, job, deps, token, timeout, read)));
 		} catch (error) {
-			job.error = `fixer collection failed: ${String(error)}; run /quest-iterate`;
+			// Keep the first reason: a GitHub error while handing back a crash must not replace the crash.
+			job.error ??= `fixer collection failed: ${String(error)}; run /quest-iterate`;
 			try {
 				save(path, job);
 				output.push(...(await collectJob(root, state, path, job, deps, token, timeout, read)));
@@ -339,6 +347,12 @@ export async function collectFixers(
 	return output;
 }
 
+/** An exit status as a cause: a signal by name (143 is SIGTERM), or a crash with its code (101 is a Rust panic). */
+function exited(code: string): string {
+	const signal = Object.entries(osConstants.signals).find(([, number]) => 128 + number === Number(code))?.[0];
+	return signal ? `stopped by ${signal} (exit ${code})` : `crashed (exit ${code})`;
+}
+
 async function collectJob(
 	root: string,
 	state: string,
@@ -352,10 +366,13 @@ async function collectJob(
 	const github = new GitHub(deps);
 	const output: string[] = [];
 	if (!job.results && !job.error) {
+		// A restart stops the daemon's whole unit, fixers included, unless the host keeps them running.
+		const daemon = identity(process.pid);
+		const restarted = job.daemon && daemon && job.daemon !== daemon ? "; the daemon restarted while it ran" : "";
 		if (existsSync(`${path}.exit`)) {
 			const code = readFileSync(`${path}.exit`, "utf8");
 			if (job.terminating !== undefined) job.error = "fixer timed out; run /quest-iterate";
-			else if (code !== "0") job.error = `fixer crashed (exit ${code}); run /quest-iterate`;
+			else if (code !== "0") job.error = `fixer ${exited(code)}${restarted}; run /quest-iterate`;
 			else
 				try {
 					job.results = parseFixResult(readFixResult(job.checkout), job.numbers);
@@ -380,8 +397,10 @@ async function collectJob(
 				} catch {}
 			}
 			job.error = "fixer timed out; run /quest-iterate to diagnose and retry";
-		} else if (job.pid && job.identity && identity(job.pid) === job.identity) return output;
-		else job.error = "fixer disappeared before recording an exit status; run /quest-iterate";
+		}
+		// Without a launch identity (an unreadable /proc), only its exit status or the timeout can end the job.
+		else if (!job.identity || (job.pid && identity(job.pid) === job.identity)) return output;
+		else job.error = `fixer stopped without recording an exit status${restarted}; run /quest-iterate`;
 		save(path, job);
 	}
 	while (job.numbers.length) {
@@ -420,7 +439,7 @@ async function collectJob(
 					if (entry.repository !== job.plan.repository && !entry.maintainerCanModify)
 						throw new FixerRefusal("fork does not allow maintainer edits");
 					try {
-						importFixer(root, state, job.checkout, number, head);
+						importFixer(root, state, job.checkout, number, head, job.packs);
 					} catch (error) {
 						throw new FixerRefusal(String(error));
 					}